istio: Injecting sidecar breaks websocket connection

Deploying Node-red on k8s and exposing through ingress works fine until I modify my deployment to inject istio sidecar.

kubectl describe ing –>

Name:                   hello-nodered
Namespace:              default
Address:
Default backend:        default-http-backend:80 (11.1.25.132:8080)
Rules:
  Host  Path    Backends
  ----  ----    --------

  *
        /hello  hello-nodered:1880 (<none>)
Annotations:
  websocket-services:   hello-nodered
  enable-cors:          true
  rewrite-target:       /
  ssl-redirect:         false
No events.

Now, if I do

kubectl get deployment/hello-nodered -o yaml | istioctl kube-inject -f - | kubectl apply -f -

the websocket connection from the editor does not work anymore:

I tried both ingress annotations kubernetes.io/ingress.class: "istio" and kubernetes.io/ingress.class: "nginx", but always same issue. So I really suspect this is caused by the injected sidecar proxy.